chore(deps): update vmactions/netbsd-vm action to v1.4.9

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
vmactions/netbsd-vm	action	patch	v1.4.6 → v1.4.9

---

Release Notes

vmactions/netbsd-vm (vmactions/netbsd-vm)

v1.4.9

Compare Source

support "11.0-microvm", which boots in 7 seconds.
fix pkgsrc.

Full Changelog: vmactions/netbsd-vm@v1.4.8...v1.4.9

v1.4.8

Compare Source

Package mirrors: probe first, then trust

On 2026-08-30 the NetBSD.org package hosts went down together --
cdn.NetBSD.org and ftp.NetBSD.org are the same infrastructure behind a
CDN, not independent mirrors -- and every pkg_add in every job spent
minutes per package in TLS timeouts before dying.

The VM now probes the package mirrors at startup and points pkg_add at
the ones that actually answer: cdn.NetBSD.org, ftp.NetBSD.org, the
official French mirror ftp.fr.NetBSD.org, ftp.jaist.ac.jp and
ftp.allbsd.org, in that order, keeping only the live ones. Dead hosts
are dropped entirely rather than kept as fallbacks, because pkg_add
walks the whole list for every package it installs, and each dead
https entry costs minutes per package. If nothing answers, the
configuration is left untouched.

This also retires a long-standing trap in the image's default
configuration: its PKG_PATH ended with a NetBSD 9.0 fallback, so a
package missing from the preferred hosts was silently installed from
the 9.0 set, linked against libraries the running release does not
ship. All entries are now same-release only.

The probe runs on every VM start, including boots from a
cache-after-prepare image, so the mirror list is always from the
current run, never frozen into a cache. Verified during the outage
itself: with both NetBSD.org hosts dead, prepare installed its
packages from the French mirror on the first try.

Under the hood

The runtime moves to anyvm v0.6.6. Changes under hooks/ now retrigger
the project generation, so a hook fix is picked up by the test matrix
without waiting for the daily rebuild.

Full Changelog: vmactions/netbsd-vm@v1.4.7...v1.4.8

v1.4.7

Compare Source

sync: tar

A new way to share the workspace: the tree is streamed in as a ustar
archive over the ssh connection the action already opens, and streamed
back the same way when the run finishes. Nothing is installed in the
guest and no filesystem support is needed on either side, unlike sshfs
and nfs. netbsd-builder v2.2.3 declares it for every release conf --
including the images that ship no rsync at all, where tar is the first
stream-based option. Verified on this guest before the declaration went
in: 300 files plus a 1 MB binary blob pushed, a file written inside the
VM, the whole tree pulled back and compared by content hash.

rsync remains the default where the image ships it.

Under the hood

netbsd-builder v2.2.3 also sets the guest hostname consistently across
releases and architectures.

The runtime moves to anyvm v0.6.5, ten releases on from the v0.5.5 that
v1.4.6 shipped. Two of its fixes reach every job: a failed folder sync
is now fatal instead of a warning that left the guest running without
the files it was about to use, and the workspace push no longer carries
the runner's own harness directories into the guest.

Full Changelog: vmactions/netbsd-vm@v1.4.6...v1.4.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.